Bug 2392790 (CVE-2025-9901)

Summary: CVE-2025-9901 libsoup: Improper Handling of HTTP Vary Header in libsoup Caching
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across different requests, potentially exposing sensitive user information. While the issue is unlikely to affect everyday desktop use, it could result in confidentiality breaches in proxy or multi-user environments.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2392791, 2392793, 2392794, 2392796, 2392792, 2392795    
Bug Blocks:    

Description OSIDB Bzimport 2025-09-03 05:12:37 UTC 
Improper Cache Validation vulnerability in the SoupCache implementation of the libsoup HTTP library.The flaw is due to libsoup ignoring the HTTP Vary header when determining whether a cached response is valid for subsequent requests. This oversight occurs in the soup_cache_has_response() function, where an unimplemented check results in cached responses being reused incorrectly across different request contexts. If exploited, an attacker could cause highly sensitive or user-specific content to be served to unintended recipients, resulting in serious information disclosure. The issue is only relevant to applications that explicitly enable SoupCache, and exploitation is more plausible in proxy-like scenarios rather than standard GNOME desktop use cases.